Summary
- Environment: Not publicly identified
- Operational impact: No outage or recovery duration quantified
- Financial impact: No public cost estimate
- Record status: Developing record. Reviewed August 9, 2026; updated as evidence emerges.
What happened
Impact
A verified HIBP corpus associated with the March 2026 SUCCESS incident, distinct from the first-party content-abuse confirmation. [1]
Documented data types include:
- Names — Names listed in HIBP’s corpus description and DataClasses. [1]
- Account credentials — Bcrypt password hashes for a limited number of staff records according to HIBP; no plaintext-password exposure is asserted. [1]
- IP addresses — IP addresses listed in HIBP’s DataClasses. [1]
- Purchase history — Order and purchase information listed by HIBP, including the payment method used; this is not a claim that payment-card or financial-account numbers were exposed. [1]
- Contact information — Email addresses, phone numbers, and order physical addresses listed by HIBP. [1]
A cited record reports 253,510 records (Unique email addresses represented in HIBP’s verified corpus; not a SUCCESS-confirmed count of affected people, customers, staff, accounts, orders, or total rows; as of 2026-04-01). [1]
SUCCESS said it removed the offensive content, locked down the admin system, replaced its authentication system, and deployed content-moderation filters within two hours. [2]
Timeline
Documented event
Date of unauthorized admin-dashboard access and content abuse confirmed by SUCCESS; the access start time and duration before the afternoon activity were not disclosed.
[2]Public disclosure
Unauthorized access to the SUCCESS.com administrative system, publication of offensive content, and sending of an unauthorized newsletter.
[2]Briefing updated
This briefing was last reviewed and updated on August 9, 2026.
Threat Group & Attack Vector
SUCCESS said the attacker exploited a vulnerability in its system. [2]
Actors
- No threat actor group has been identified in the reviewed public evidence.
TTPs
- No specific MITRE ATT&CK technique is currently mapped for this case.
Response
SUCCESS said an unauthorized individual accessed its admin dashboard, published offensive content on its website, and sent at least one newsletter containing hate speech and fabricated contributor quotations. SUCCESS said it eliminated password-based login, added server-side moderation, restricted newsletter sending to senior administrators, and conducted a full security audit of admin systems. HIBP marked the SUCCESS incident record verified and not fabricated. No access path, attribution, scale, or recovery detail is inferred beyond the cited claims. [1][2]